🔍 Read the full analysis: Google Targets TV Box Botnet Fueled By Factory-Linked Malware on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said on Nov. 2 that it and industry partners, with Japan’s National Police Agency, had disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million set-top boxes. Google accuses device maker Videostrong of building and operating the firmware backdoor for profit; the company did not respond to media requests cited in the source report. The disruption does not remove the backdoor from affected devices, which may reinstall it after a reboot.
Google said on Nov. 2 that it had worked with industry partners and Japan’s National Police Agency to disrupt the control infrastructure of XCPE, a botnet linked to more than 1.3 million set-top boxes. Google attributes the firmware backdoor behind the network to device maker Videostrong Technology Co., alleging that the company developed and operated it for profit; the disruption does not remove the backdoor from affected boxes.
Google’s Threat Intelligence Group (GTIG) said the operation took place in late October and involved legal action to disable domains and servers used to control XCPE and distribute malware. Google also said it took action against control servers used by more than a dozen other malware families found as add-ons on the boxes. Its work involved Lumen, HUMAN Security, Plume, Synthient and TrendAI, as well as Japan’s National Police Agency.
Google said the devices’ firmware contained a system app identified in some builds as x.cpe or com.oemservice. According to GTIG, it could contact a control server, download settings and allow operators to install apps, run commands, capture screens and scan local networks. The malware could also disable Google Play Protect checks before installing additional software. Google says the backdoor can reinstall itself from a protected partition after a reboot, so deleting an app may not remove it.
The boxes were used mainly as residential proxies, routing other parties’ internet traffic through owners’ home connections, and for advertising fraud. Google also reported capabilities including keystroke injection and collection of account and device data. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing its count as a lower bound. Google’s public estimate was more than 1.3 million set-top boxes.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Factory Firmware Changes the Risk
The case matters because the alleged entry point was not a fake app or a user clicking a malicious link: Google says the backdoor was built into device firmware before boxes reached customers. That shifts the security problem from individual downloads to the supply chain and the software installed by manufacturers. Owners may have little practical way to identify or remove a system-level component themselves.
A compromised box can also make a household or office internet connection appear to be the source of traffic generated by someone else. That may expose the connection’s reputation and create risks for other devices on the same network. Google’s reported observations of remote access and local network scanning add to those concerns, although the source material does not establish that every infected device carried out every listed activity.
Google said the shutdown of control servers for add-on malware could cut off access to at least 10 million additional compromised devices. That is an estimate of wider effects, not a verified device count; the source report says the affected devices may not all run Android. The actions may interrupt operators’ access, but they do not, by themselves, clean the infected TV boxes.
Products Worth Considering
Philips Hue Play HDMI Sync Box 4K with 65-Inch Play Gradient Light Strip
Philips Hue Play Screen Sync and 65-Inch Play Gradient Smart TV Light Strip
eufy Security Video Doorbell E340, Dual Cameras, 2K FHD, 8GB Local Storage
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” describes Videostrong as an Android original equipment and original design manufacturer: a company that builds devices for its own brand and for other brands. Google said it had high confidence that Videostrong intentionally developed, deployed and operated the backdoor for financial gain, including by selling access to criminal partners. This is Google’s assessment; the source material does not include a public court filing or a response from Videostrong.
Google said some infected boxes were Google-certified. It alleges that obfuscation and code loaded after the first boot allowed malicious software to pass its earlier checks. In response, Google said it banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tightened firmware-integrity checks for certified Android TV devices.
TrendAI’s device count covers the period from June 3 to Oct. 1, 2026. Google’s separate figure is phrased as more than 1.3 million set-top boxes. These figures describe the scale reported by the companies; they do not establish how many devices remain active or how many owners were directly affected by misuse of their connections.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group, in its report “Shutting the Door on the XCPE Botnet”
What the Disruption Did Not Resolve
The available source material does not identify a public court case number or court, and it does not include a response from Videostrong. Google’s accusation about the company’s conduct should therefore be understood as an attributed claim. The precise number of devices still infected, the number whose owners’ connections were used, and the extent of any resulting harm are also unclear.
Disabling control servers cuts off an important route for remote commands, but the backdoor reportedly remains in firmware and can restore itself after reboot. The source material does not say whether Google or device makers have released a reliable cleanup update for affected models, or provide a complete list of model names and manufacturers. It is also unclear how many of the additional devices in Google’s 10 million estimate were reached through the same operation or are still accessible to malware operators.
Firmware Checks and Owner Actions
Google said it has tightened integrity checks for firmware on certified Android TV devices and barred Videostrong and future affiliates from participating in its certified-device program. Those changes target future certification and supply-chain risks; the source material does not specify when the new checks took effect or which already-sold devices will receive changes.
Owners can check whether a box is Play Protect certified, but certification alone may not identify every compromised unit, given Google’s report that some infected boxes were certified. People concerned about an unfamiliar or no-name device can treat it as untrusted, unplug or replace it, and keep TV boxes on a separate guest network where possible. Businesses should account for home and office internet-connected devices in their security planning, rather than relying only on IP reputation to judge where traffic originates. Further information about affected models, remediation and the legal actions may clarify how many devices can be secured without replacement.
Key Questions
What did Google do to XCPE?
Google said it and partners disrupted the botnet’s control infrastructure in late October, including domains and servers used to control devices and distribute malware.
How many devices were linked to the botnet?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and called its figure a lower bound.
Does the takedown remove malware from an affected box?
Not necessarily. Google says the backdoor remains in firmware and can reinstall itself after a reboot. The source material does not identify a complete cleanup method or list all affected models.
What did Google allege about Videostrong?
Google said with high confidence that Videostrong Technology Co. developed and operated the backdoor for financial gain. The source material says the company did not respond to media requests; it does not include a public court filing.
What should owners do if they are concerned?
Check the device’s Play Protect certification, but do not treat certification as proof that a box is safe. Consider unplugging or replacing a suspicious device and placing TV boxes on a separate guest network.
Source: ThorstenMeyerAI.com
